Brought to you bySOX 404 · Enterprise Risk · IT Controls · Pre-IPO Readinesssidelookllc.com
Get the daily briefing
Free. One email each weekday morning. The SOX, SEC, PCAOB, and AI governance stories that matter, in a three-minute read.
The daily edition
SATURDAY, NOVEMBER 7, 2026
If an employee can connect an AI tool to your corporate data without anyone who owns the risk saying yes, your AI policy is a document, not a control. / In focus
Shadow AI is connected to your systems, and the budget did not stop it
DNSFilter's survey of 400 IT and security professionals finds 46% have had an unapproved AI tool connected to their systems, and one in five say it caused an incident.
The Take: If an employee can connect an AI tool to your corporate data without anyone who owns the risk saying yes, your AI policy is a document, not a control.
DNSFilter·Nov 2
Today's stories
AI & Technology
90% of internal audit functions use AI. Only 53% auditing it check whether it works
Sikich's survey finds 90% of internal audit functions use AI and 77% include AI assessments in audit plans, but among those auditing AI only 53% review operational effectiveness.
CPA Practice Advisor·Nov 1
AI & Technology
AI sprawl is not just a legal issue
An in-house counsel guide warns that AI-driven demands look rigorous but lack substance, and answering them point by point only feeds the spiral. Auditors see the same pattern in compliance reviews.
ACC Corporate Counsel Now·Nov 3
SEC & Regulation
An SEC commissioner wants the corporate penalty framework revisited, and individuals held to account
Commissioner Uyeda says the SEC's 2006 Corporate Penalty Statement should be revisited, and penalties should fall on responsible individuals, not shareholders.
SEC·Nov 1
Sarbanes-Oxley
A three-year material weakness is finally closed, and the fix was boring on purpose
PSQ Holdings says a three-year material weakness over cash flow statement presentation is remediated as of September 30, 2026.
BusinessWire·Nov 5
Governance
Polestar pushed its Q3 results two days out, and said nothing about which part of the close needed more time
Polestar postponed its Q3 results from November 5 to a date to be announced, saying it needs more time to conclude the quarter-end close.
BusinessWire·Nov 2
Events and podcasts
Conferences, webinars, and podcasts for SOX, internal audit, and compliance professionals.
BDO: AI is now inside the estimates your auditor reviews, and the proof is not keeping up
BDO's third annual Audit Innovation Survey finds 99% of finance leaders use AI in at least one estimate or judgment the external auditor reviews, while only 49% can fully explain and substantiate AI-assisted outputs.
BDO·Nov 3
Sarbanes-Oxley
From the editor: As AI labs go public, test these six areas before the second 10-K
Anthropic's amended S-1 is the first real test of ICFR at an AI lab, and the watchlist says test six areas before the second 10-K.
Anthropic·Nov 1
Compliance
Block agrees in principle to a $764 million DOJ deal over Cash App anti-money-laundering failures
Block's Q3 10-Q says the DOJ deal would resolve the probe through a three-year deferred prosecution agreement, with about $764 million accrued.
Block·Nov 2
Compliance
Warren presses DOJ for a criminal probe of Bank of America after $1.2 billion in AML penalties
Senator Warren is urging a DOJ criminal investigation after Bank of America admitted willful BSA violations, and a new class action alleges over $5 billion in unreported suspicious transactions.
U.S. Department of the Treasury·Oct 12
SEC & Regulation
SEC raises small-entity thresholds for the first time since 1998
The Commission raised the small-adviser threshold from $25 million to $1 billion and the small-fund threshold from $50 million to $10 billion.
SEC·Nov 3
AI & Technology
Sensiba becomes one of the first CPA firms accredited to audit AI agents
Sensiba is now a fully accredited AIUC-1 assessor after a witness audit of Cresta, one of only a few firms accredited to audit AI agents.
Sensiba·Nov 3
Sarbanes-Oxley
Driven Brands restates three years and 2026 quarters over fixed-asset errors, delays Q3 10-Q
Driven Brands' audit committee found material fixed-asset errors across three fiscal years plus 2025, 2024, and 2026 periods; Q3 10-Q delayed, restatement costs at least $50 million in 2026.
Driven Brands·Nov 1
Compliance
FASB proposes simpler indexation test for equity-linked contracts
FASB's November 2 proposal would eliminate the fixed-for-fixed assessment for equity-linked contracts under Subtopic 815-40.
FASB·Nov 1
Risk & Audit
PCAOB issues AS 6101 comfort-letter proposal for comment
The PCAOB issued targeted AS 6101 amendments for comment, removing the day-count convention that can block negative assurance in comfort letters.
PCAOB·Nov 2
SEC & Regulation
SEC staff calls Canton Coin a digital commodity in November 3 no-action letter
Division of Corporation Finance staff said it would not recommend enforcement action over Canton Coin's programmatic issuance without securities registration, under the conditions described.
SEC·Nov 2
Compliance
AICPA ethics draft tackles private-equity alternative practice structures
PEEC voted November 3 to publish an exposure draft changing the Code of Professional Conduct for alternative practice structures, including private equity investment.
AICPA·Nov 2
Risk & Audit
SEC approves scaled-back QC 1000 amendments, effective December 15
The SEC approved the PCAOB's targeted QC 1000 amendments on November 2, with the December 15, 2026 effective date unchanged.
SEC·Nov 1
SEC & Regulation
OKX-ICE tokenized venue objections reach 50 as the 30-day window closes
OKXICE's October 30 notice lists 50 objecting issuers, up 12 in two days, and the venue still gives no trading start date.
OKXICE·Oct 29
Governance
PLDT auditor resigns over independence breach on FY2025 opinions
SGV, an EY member firm, resigned after concluding it was not independent when it issued opinions on PLDT's FY2025 financial statements and internal control over financial reporting.
First Pacific·Nov 2
AI & Technology
Gartner: AI strategy miscalculation is now a top-three emerging risk
Gartner's 3Q26 emerging risk report puts AI strategy miscalculation third, behind AI discovery of cyber vulnerabilities and geopolitical energy supply shocks.
Gartner·Nov 1
Sarbanes-Oxley
GoodRx restates Q1 and Q2 2026 after understating Pharma Direct revenue, expects material weaknesses
GoodRx says its Q1 and Q2 2026 statements should no longer be relied upon after Pharma Direct revenue was understated under ASC 606.
GoodRx·Nov 1
AI & Technology
SEC enforcement chief says the agency is examining AI companies' corporate disclosures
Woodcock told Reuters accurate AI disclosure is now an enforcement topic, and where it does not happen, enforcement will be present.
Reuters·Oct 29
Governance
Revolve discloses payment-card data exposure in an 8-K, and says it does not expect a material impact
An unauthorized actor may have obtained saved payment-card data for certain customers; Revolve filed under Item 8.01, not Item 1.05.
Revolve Group, Inc.·Oct 28
Risk & Audit
PCAOB meets Tuesday on proposed comfort-letter changes
The Board will consider proposed targeted amendments to AS 6101 on negative assurance in comfort letters; no proposal has been issued yet.
Public Company Accounting Oversight Board·Oct 28
SEC & Regulation
SEC issues exemptive relief from Treasury clearing rules for certain repo transactions
Release 2026-111 excludes certain non-U.S.-counterparty and inter-affiliate repos from the Treasury clearing definition, with conditions.
U.S. Securities and Exchange Commission·Oct 29
Risk & Audit
SPYR engages a PCAOB auditor as a first step toward SEC registration
FM Financial Services will audit 2024-2025 statements plus 2026 quarterly reviews to support a planned registration statement.
SPYR, Inc.·Oct 29
Sarbanes-Oxley
GoPro restates 2025 and first-half 2026 results over debt accounting errors, and its material weakness is still open
Warrant and convertible-debt errors tripped defaults under all four debt instruments, and ICFR was ineffective at four consecutive quarter-ends.
GoPro, Inc.·Oct 15
SEC & Regulation
SEC charges two firms in a $130 million fraud built on false SEC filings
BG Wealth and DSJ Exchange allegedly pointed investors to false Form ADV and Form D filings as proof of SEC approval.
U.S. Securities and Exchange Commission·Oct 28
AI & Technology
Internal audit is experimenting with AI, but governance and judgment are still the top agenda items
Polling of more than 2,000 auditors finds most still at individual experimentation, with AI governance the top next step.
Wolters Kluwer·Oct 14
AI & Technology
Banks expect AI to make credit and risk decisions on its own within five years, but only 18 percent have governance to match
Ambition is measured, and so is the governance gap behind it.
SAS·Oct 21
Sarbanes-Oxley
Endava to restate fiscal 2026 results after audit committee finds customer-supplier deals lacked economic substance
An audit committee investigation found customer-supplier deals without economic substance, and a restatement plus material weaknesses followed.
Endava·Oct 27
Governance
Boards say they have AI governance frameworks, but only about a third are confident they have the skills to run them
The framework exists on paper in most boardrooms; the expertise to challenge it lags behind.
BDO USA·Oct 18
Governance
Nidec to sue its founder and eight former executives over accounting irregularities
A board that learns of accounting problems from outside lawyers has already failed the first control test.
Nidec Corporation·Oct 26
Sarbanes-Oxley
Ocean Power Technologies dismisses Baker Tilly and discloses material weaknesses and a going-concern doubt
An auditor change, a going-concern paragraph, and material weaknesses in one filing point the same way.
Ocean Power Technologies, Inc.·Oct 27
Compliance
AICPA, ASA, and RICS seek comment on a valuation performance framework, comments due December 22
A framework change for valuers reaches audit evidence wherever fair value feeds the statements.
American Society of Appraisers·Oct 7
Risk & Audit
AI fraud is now a top concern, but AI governance in the risk functions themselves is still thin
AI fraud tops the worry list while AI governance inside risk functions stays thin.
Grant Thornton·Oct 12
SEC & Regulation
IPOs are on ice, with 13 postponed this year, but the readiness work does not pause with the timing
Postponements are up, but the IPO readiness work does not pause with timing.
CFO Brew·Oct 27
Risk & Audit
AICPA proposes the first SOC 2 criteria rewrite since 2017, with AI points of focus but no standalone AI criteria
The first criteria rewrite since 2017 trims complexity and adds AI points of focus, but no standalone AI criteria.
American Institute of CPAs·Oct 25
AI & Technology
AI agents now make decisions humans used to approve, and half of companies cannot fully audit what they do
Authority given to AI agents is outrunning the ability to audit them.
If an employee can connect an AI tool to your corporate data without anyone who owns the risk saying yes, your AI policy is a document, not a control. / In focus